How do you change your data protection provider?

If your provider is also your data protection officer (DPO), the change has legal steps. UK law says you must publish your DPO's contact details and give them to the UK data protection regulator. Your privacy notice must carry them too. You can update the regulator's copy online.

Write down what you need from the next provider before you look. Your needs may have grown since the last contract, for example with a first AI policy or a new sector rule. The guide to how these services are priced explains the usual ways of charging, and what a retainer tends to cover.

How to change data protection provider: the handover steps

1. Ask for your records back first. That means your record of processing, impact assessments, policies, breach log, training records and any letters to and from the regulator.
2. Read your contract for the notice period and any charge for handing over files before you give notice.
3. Check the new provider's named people and their qualifications with the body that issued them.
4. Overlap the two contracts by a few weeks, so someone answers for a breach on every day of the switch.
5. Ask the new provider to read what you already have before it proposes any changes.
6. Update your DPO's details with the UK data protection regulator and in your privacy notice on the day the new appointment starts.

Changing data protection provider: common questions

Do we have to tell the regulator we changed provider?

You must tell the regulator if the provider is your data protection officer. UK law says you must give the UK data protection regulator your DPO's contact details, so a new DPO means new details. An outside firm can hold the role.

Will we get our data back?

You can choose to have your data returned, if the provider handled personal data for you. UK law says your contract must make the provider return or delete that data when the service ends, at your choice. Say which you want in writing, and ask for confirmation that copies are deleted.

Who handles a breach during the handover?

Agree in writing who handles a breach before the switch, so someone is on call every day. Under UK law, a breach that must be reported goes to the UK data protection regulator without undue delay. Where feasible, it must arrive within 72 hours of you becoming aware of it.

Our provider also sells software. Does that matter?

Selling software can matter if the provider is also your DPO. UK rules say a DPO must operate independently, with no conflict of interests.